{
  "data": {
    "aws_caller_identity": {
      "current": {}
    },
    "aws_partition": {
      "current": {}
    },
    "aws_region": {
      "current": {}
    }
  },
  "provider": {
    "aws": {
      "region": "us-east-1"
    }
  },
  "resource": {
    "aws_cloudtrail": {
      "org": {
        "depends_on": [
          "aws_s3_bucket_policy.audit"
        ],
        "enable_log_file_validation": true,
        "is_multi_region_trail": true,
        "kms_key_id": "${aws_kms_key.audit.arn}",
        "name": "sysbuild-org-trail",
        "s3_bucket_name": "${aws_s3_bucket.audit.id}"
      }
    },
    "aws_flow_log": {
      "main": {
        "log_destination": "${aws_s3_bucket.audit.arn}",
        "log_destination_type": "s3",
        "traffic_type": "ALL",
        "vpc_id": "${aws_vpc.main.id}"
      }
    },
    "aws_iam_account_password_policy": {
      "strict": {
        "max_password_age": 90,
        "minimum_password_length": 14,
        "require_lowercase_characters": true,
        "require_numbers": true,
        "require_symbols": true,
        "require_uppercase_characters": true
      }
    },
    "aws_kms_key": {
      "audit": {
        "description": "SysBuild audit log encryption key",
        "enable_key_rotation": true,
        "policy": "{\"Statement\":[{\"Action\":\"kms:*\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:root\"},\"Resource\":\"*\",\"Sid\":\"EnableRootAccountAdmin\"},{\"Action\":\"kms:GenerateDataKey*\",\"Condition\":{\"StringLike\":{\"kms:EncryptionContext:aws:cloudtrail:arn\":\"arn:${data.aws_partition.current.partition}:cloudtrail:*:${data.aws_caller_identity.current.account_id}:trail/*\"}},\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Resource\":\"*\",\"Sid\":\"AllowCloudTrailEncrypt\"},{\"Action\":\"kms:DescribeKey\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Resource\":\"*\",\"Sid\":\"AllowCloudTrailDescribeKey\"}],\"Version\":\"2012-10-17\"}"
      }
    },
    "aws_s3_bucket": {
      "audit": {
        "bucket": "${var.audit_bucket_name}"
      }
    },
    "aws_s3_bucket_policy": {
      "audit": {
        "bucket": "${aws_s3_bucket.audit.id}",
        "policy": "{\"Statement\":[{\"Action\":\"s3:GetBucketAcl\",\"Condition\":{\"StringEquals\":{\"aws:SourceArn\":\"arn:${data.aws_partition.current.partition}:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/sysbuild-org-trail\"}},\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Resource\":\"${aws_s3_bucket.audit.arn}\",\"Sid\":\"AWSCloudTrailAclCheck\"},{\"Action\":\"s3:PutObject\",\"Condition\":{\"StringEquals\":{\"aws:SourceArn\":\"arn:${data.aws_partition.current.partition}:cloudtrail:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:trail/sysbuild-org-trail\",\"s3:x-amz-acl\":\"bucket-owner-full-control\"}},\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"cloudtrail.amazonaws.com\"},\"Resource\":\"${aws_s3_bucket.audit.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*\",\"Sid\":\"AWSCloudTrailWrite\"},{\"Action\":\"s3:GetBucketAcl\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"delivery.logs.amazonaws.com\"},\"Resource\":\"${aws_s3_bucket.audit.arn}\",\"Sid\":\"AWSLogDeliveryAclCheck\"},{\"Action\":\"s3:PutObject\",\"Condition\":{\"StringEquals\":{\"s3:x-amz-acl\":\"bucket-owner-full-control\"}},\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"delivery.logs.amazonaws.com\"},\"Resource\":\"${aws_s3_bucket.audit.arn}/AWSLogs/${data.aws_caller_identity.current.account_id}/*\",\"Sid\":\"AWSLogDeliveryWrite\"}],\"Version\":\"2012-10-17\"}"
      }
    },
    "aws_s3_bucket_public_access_block": {
      "audit": {
        "block_public_acls": true,
        "block_public_policy": true,
        "bucket": "${aws_s3_bucket.audit.id}",
        "ignore_public_acls": true,
        "restrict_public_buckets": true
      }
    },
    "aws_s3_bucket_server_side_encryption_configuration": {
      "audit": {
        "bucket": "${aws_s3_bucket.audit.id}",
        "rule": {
          "apply_server_side_encryption_by_default": {
            "kms_master_key_id": "${aws_kms_key.audit.arn}",
            "sse_algorithm": "aws:kms"
          }
        }
      }
    },
    "aws_s3_bucket_versioning": {
      "audit": {
        "bucket": "${aws_s3_bucket.audit.id}",
        "versioning_configuration": {
          "status": "Enabled"
        }
      }
    },
    "aws_vpc": {
      "main": {
        "cidr_block": "10.0.0.0/16",
        "enable_dns_hostnames": true,
        "enable_dns_support": true
      }
    }
  },
  "terraform": {
    "required_providers": {
      "aws": {
        "source": "hashicorp/aws",
        "version": "~> 5.0"
      }
    }
  },
  "variable": {
    "audit_bucket_name": {
      "description": "Globally-unique name for the SOC 2 audit log bucket.",
      "type": "string"
    }
  }
}